Why do you want to work in threat intelligence rather than another security discipline?

A strong answer has three parts: an accurate picture of the work, a specific personal reason, and evidence you have already been doing some of it.

On the work: intelligence is a research and communication job. A realistic week involves triaging collection, enriching a few clusters of activity, mapping behaviour to a framework, and writing — a lot of writing — for people who are not in the SOC. Candidates who describe the role as "hunting APTs" tend to be describing a version of the job that does not exist.

On the reason: something specific carries more weight than a general interest in security. Preferring the analytic side to the operational one, wanting to work on the question of why an adversary does something rather than only what they did, or coming from a research or languages background where source evaluation was already the core skill — any of these are credible because they are checkable.

On the evidence: the strongest answers point at something concrete. An intrusion set you have tracked and written about, a Sigma rule you contributed, sustained participation in a sharing community, or a blog post with explicit confidence language. This turns a motivation answer into a demonstration.

Honesty about the parts that are tedious is a plus, not a risk. Interviewers have all done the processing work and know it dominates the early years.